Zimbra
Coverage of Zimbra in the Nexus archive.
- Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation
Russian threat actors are exploiting a vulnerability in Microsoft Outlook Web Access (OWA) to maintain mailbox access after credential rotation, targeting U.S. and European government entities and sectors like telecommunications, financial, hospitality, and aerospace. This follows their prior exploitation of a Zimbra vulnerability.
- Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-supported espionage group exploited a previously unknown vulnerability in Zimbra's webmail client to steal emails, password data, and two-factor authentication recovery codes. The attack, which targeted the last 90 days of email and an organization's directory, was disclosed by the NSA, CISA, and partner agencies.
- Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
Zimbra is urging customers to apply updates to address a critical security vulnerability in the Classic Web Client that could allow arbitrary code execution via stored cross-site scripting (XSS). The flaw could enable malicious scripts to run in user sessions through specially crafted emails and has not yet been assigned a CVE identifier.
- Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks
Over 10,000 Zimbra Collaboration Suite (ZCS) servers are exposed online and vulnerable to ongoing cross-site scripting (XSS) attacks. The security flaw allows attackers to exploit these servers through malicious scripts.